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Abstract. Justification logics are epistemic logics that explicitly include 
justifications for the agents' knowledge. We develop a multi-agent jus- 
tification logic with evidence terms for individual agents as well as for 
common knowledge. We define a Kripke-style semantics that is similar to 
Fitting's semantics for the Logic of Proofs LP. We show the soundness, 
^~j completeness, and finite model property of our multi-agent justification 

Cu logic with respect to this Kripke-style semantics. We demonstrate that 

^ our logic is a conservative extension of Yavorskaya's minimal bimodal ex- 

plicit evidence logic, which is a two-agent version of LP. We discuss the 
^ relationship of our logic to the multi-agent modal logic S4 with common 

__^ knowledge. Finally, we give a brief analysis of the coordinated attack 

problem in the newly developed language of our logic. 
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Justification logics |Art08| are epistemic logics that explicitly include justifica- 
tions for the agents' knowledge. The first logic of this kind, the Logic of Proofs LP, 
was developed by Artemov [Art95j lArtOlj to provide the modal logic S4 with 
QQ provability semantics. The language of justification logics has also been used to 

■^ create a new approach to the logical omniscience problem |AK09I and to study 

^^ self-referential proofs (KuzlOj . 

IY~s Instead of statements A is known, denoted D^, justification logics reason 

f^ about justifications for knowledge by using the construct [t]A to formalize state- 

^^ ments t is a justification for A, where evidence term t can be viewed as an 

", , informal justification or a formal mathematical proof depending on the appli- 

^ cation. Evidence terms are built by means of operations that correspond to the 

axioms of S4, as is illustrated in Fig. [T] 

Artemov |Art01| has shown that the Logic of Proofs LP is an explicit coun- 
C^ terpart of the modal logic S4 in the following formal sense: each theorem of LP 

becomes a theorem of S4 if all terms are replaced with the modality D; and, 
vice versa, each theorem of S4 can be transformed into a theorem of LP if occur- 
rences of modality are replaced with suitable evidence terms. The latter process 
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S4 cLxioms LP axioms 

a{A -^ B) ^ {DA ^ OB) [t]{A ^ B) ^ {[s]A ^ [t ■ s]B) (application) 

aA^ A [t]A^ A (reflexivity) 

nA-5>nnA [t]^^ [!*][*] a (inspection) 

[t]A V [s]A ^ [t + s]A (sum) 

Fig. 1. Axioms of S4 and LP 



is called realization, and the statement of correspondence is called a realization 
theorem. Note that the operation + introduced by the sum axiom in Fig. [l] 
does not have a modal analog, but it is an essential part of the proof of the 
realization theorem in [A rtOlj . Explicit counterparts for many normal modal 
logics between K and S5 have been developed (see a recent survey in |Art08| and 
a uniform proof of realization theorems for all single-agent justification logics 
forthcoming in [BGKlOj ). 

The notion of common knowledge is essential in the area of multi-agent sys- 
tems, where coordination among agents is a central issue. The standard text- 
books |FHMV95l IMvdH95] provide excellent introductions to epistemic logics 
in general and common knowledge in particular. Informally, common knowledge 
of A is defined as the infinitary conjunction everybody knows A and everybody 
knows that everybody knows A and so on. This is equivalent to saying that com- 
mon knowledge of A is the greatest fixed point of 

AX. (everybody knows A and everybody knows X) . (1) 

Artemov IArt_Q6j has created an explicit counterpart of McCarthy's any fool 
knows common knowledge modality [MSHI78j , where common knowledge of A 



is defined as an arbitrary fixed point of (IT I . The relationship between the tradi- 



IMvdH95] and McCarthy's version is 



tional common knowledge from |FHMV95 
studied in [Ant07_. 

In this paper, we present a multi-agent justification logic with evidence terms 
for individual agents as well as for common knowledge, with the intention to 
provide an explicit counterpart of the /i-agent modal logic of traditional common 
knowledge S4^. 

Multi-agent justification logics with evidence terms for each agent have been 
considered in Yav08, Rcn09a, ArtlOj, although common knowledge is not present 
in any of them. Artemov's interest |ArtlO| lies mostly in exploring a case of 
two agents with unequal epistemic powers, e.g., Artemov's Observer has suffi- 
cient evidence to reproduce his Object Agent's thinking, but not vice versa. Ya- 
vorskaya |Yav08| studies various operations of evidence transfer between agents. 
Among their systems, Yavorskaya's minimal] bimodal explicit evidence logic, 
which is an explicit counterpart of S42, is the closest to our system. We will 
show that in the case of two agents our system is its conservative extension. 
Finally, Renne's system |Ren09aj combines features of modal and dynamic epis- 
temic logics, and hence cannot be directly compared to our system. 



^ Minimality here is understood in the sense of the minimal transfer of evidence. 



An epistemic semantics for LP, F-models, was created by Fitting in [FitOSj by 
augmenting Kripke models with an evidence function that specifies which formu- 
lae are evidenced by a term at a given world. It is easily extended to the whole 
family of single-agent justification logics (for details, see |Art08| ) . In |Art06) Arte- 
mov extends F-models to justification terms for McCarthy's common knowledge 
modality in the presence of several ordinary modalities, creating the most general 
type of epistemic models, sometimes called AF-models, where common evidence 
terms are given their own accessibility relation not directly dependent on the 
accessibility relations for individual modalities. Yavorskaya in |Yav08| proves 
a stronger completeness theorem with respect to singleton F-models, indepen- 
dently introduced by Mkrtychev |Mkr97| and now known as M-models, where 
the role of the accessibility relation is completely taken over by the evidence 
function. 

The paper is organized as follows. In Sect. [2| we introduce the language 
and give the axiomatization of a family of multi-agent justification logics with 
common knowledge. In Sect. [3] we prove their basic properties including the in- 
ternalization property, which is characteristic of all justification logics. In Sect. [4] 
we give a Fitting-style semantics similar to AF-models and prove soundness and 
completeness with respect to this semantics as well as with respect to singleton 
models, thereby demonstrating the finite model property. In Sect. [5j we show 
that for the two-agent case, our logic is a conservative extension of Yavorskaya's 
minimal bimodal explicit evidence logic. In Sect. |6j we show how our logic is 
related to the modal logic of traditional common knowledge and discuss the 
problem of realization. Finally, in Sect. IT] we provide an analysis of the coordi- 
nated attack problem in our logic. 



2 Syntax 

To create an explicit counterpart of the modal logic of common knowledge S4^, 
we use its axiomatization via the induction axiom from |MvdH95] rather than 
via the induction rule to facilitate the proof of the internalization property for 
the resulting justification logic. We supply each agent with its own copy of terms 
from the Logic of Proofs, while terms for common and mutual knowledge employ 
additional operations. As motivated in |BKSQ9| . a proof of CA can be thought of 
as an infinite list of proofs of the conjuncts E™ A in the representation of common 
knowledge through an infinite conjunction. To generate a finite representation 
of this infinite list, we use an explicit counterpart of the induction axiom 

A A [t]c{A -^ [s]eA) -^ [ind(i, s)]cA 

with a binary operation ind(-, •). To access the elements of the list, explicit coun- 
terparts of the co-closure axiom provide evidence terms that can be seen as 
splitting the infinite list into its head and tail, 

[t]cA -^ [ccli(t)]Ev4 , [t]cA -^ [ccl2(t)]E [t]cA , 



by means of two unary co-closure operations ccli(-) and ccl2(-)- Evidence terms 
for mutual knowledge are represented as tuples of the individual agents' evidence 
terms with the standard operation of tupling and with h unary projections. 
While only two of the three operations on LP terms are adopted for common 
knowledge evidence and none for mutual knowledge evidence, it will be shown in 
Sect. [3] that most remaining operations are definable with the notable exception 
of inspection for mutual knowledge. 

We consider a system of h agents. Throughout the paper, i always denotes an 
element of {1, . . . , /i}, * always denotes an element of {1, . . . , /i, C}, and ® always 
denotes an element of {1, . . . , ft., E, C}. 

Let Cons® := {cf , cf , . . . } and Var® := {xf ,x® , . . . } be countable sets of 
proof constants and proof variables respectively for each ®. The sets Tmi, . . . , 
Tm/j, Tmg, and Tmc of evidence terms for individual agents and for mutual and 
common knowledge respectively are inductively defined as follows: 

1. Cons® C Tm®; 

2. Var® C Tm®; 

3. \it G Tm^ for any t G Tnij; 

4. t +,t s G Tm* and i •* s G Tm.^ for any t, s G Tm*; 

5. (ii, . . . , th) G TmE for any ii G Tmi, . . . , th £ Tm,,; 

6. TTji G Tmj for any t G Tmn; 

7. ccli(t) G TmE and ccl2(t) G TniE for any t G Tmc; 

8. ind(t, s) G Tnic for any t G Tmc and any s G TniE. 

Tm := Tmi U • • • U Tni/j U TmE U Tmc denotes the set of all evidence terms. 
The indices of the operations !, +, and • will usually be omitted if they can be 
inferred from the context. 

Let Prop := {Pi,P2i ■ • ■ } be a countable set of prepositional variables. For- 
mulae are denoted by A, _B, C, etc. and defined by the following grammar 

A::^Pj\^A\{AaA) \ {A\J A) \ {A^A) \ [t^A , 

where t G Tm® . The set of all formulae is denoted by Fm.pc . We adopt the 

h 

following convention: whenever a formula [t]®j4 is used, it is assumed to be well- 
formed, i.e., it is implicitly assumed that term t G Tm®. This enables us to omit 
the explicit typification of terms. 



(application) 

(sum) 

(reflexivity) 

(inspection) 

(tupling) 

(projection) 

[i]c^ (co-closure) 

(induction) 



Axioms of LP,j: 








1. 


all propositional tautologies 






2. 


[tUA ^ B) ^ {[s],. 


A^[t-s 


]*B) 




3. 


[t],A^ [t + s],A, 


[s],A^ 


[t + s] 


,A 


4. 


[t],A -^ A 








5. 


[t],A ^ [H], [t],A 








6. 


[ti]iA A ■ ■ ■ A [th]hA 


-^[{h,.. 


.,M]i 


eA 
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[t]EA ^ [n,t],A 
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[t]cA ^ [cch{t)]EA, 


[t]cA ^ [ccb 
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s)]cA 





A constant specification CS is any subset 
CS ^ I J -^ [c\®A : c e Cons® and A is an axiom of LP,j > . 

®£{l,...,h,E,C} 

A constant specification CS is called C-axiomatically appropriate if for each 
axiom A, there is a proof constant c € Consc such that [c]cA € C5. A constant 
specification CS is called pure, iiCS C {[c]®^ : c € Cons® and A is an axiom} 
for some fixed ®, i.e., if for all [c]@A g CS, the constants c are of the same type. 
Let CS be a constant specification. The deductive system LP^(C5) is the 
Hilbert system given by the axioms of LP^ above and rules modus ponens and 
axiom necessitation; 

A A^ B , r 1 . ^^ 

B [c\®A 

By LP^ we denote the system V.Pf^{CS) with 

CS = \ [c\cA : c e Consc and A is an axiom of LP,, > . (2) 



For an arbitrary CS, we write A h^s A to state that A is derivable from A 
in LP^(C5) and omit the mention of CS when working with the constant speci- 
fication from pi) by writing A\- A. We use A, A to mean A U {A}. 



3 Basic Properties 

In this section, we show that our logic possesses the standard properties expected 
of any justification logic. In addition, we show that the operations on terms in- 
troduced in the previous section are sufRcient to express the operations of sum 
and application for mutual knowledge evidence and the operation of inspection 
for common knowledge evidence. This is the reason why +e, -e, and !c are not 
primitive connectives in the language. It should be noted that no inspection op- 
eration for mutual evidence terms can be defined, which follows from Lemma [27| 
in Sect. [6] and the fact that EA — > EEA is not a valid modal formula. 
We begin with the following observation: 

Lemma 1. For any constant specification CS and any formulae A and B: 

1. \-cs Me^ — > A for all t € TmE/ (E-reflexivity) 

2. for any t, s G TmE, there is a term i -e s G TniE such that 

^CS [tJE^A -^ B) ^ {[s\eA -^ [t -E s\eB); (E- application) 

3. for any t, s (z Thie, there is a term t +e s G Tuie such that 

^cs [t]EA -> [t +E s]eA and hcs [s]eA -^ [t +e s]eA; (E-sum) 

4- for any t G Tmc and any i G {1, . . . , h}, there is a term }^it G Tm^ such that 

I^CcS Mc^ -^ [iit\iA; (i-conversion) 

5. \-cs \t\cA -^ A for all t G Tnic- (C-reflexivity) 

Proof. 1. Immediate by the projection and reflexivity axioms. 



2. Set t-Es:= {nit -i ttis, . .. ,nht-h tths). 

3. Set i+E s := (vrii +i ttis, . . . ,TTht+h tt/is). 

4. Set J,it := 7riCcli(i). 

5. Immediate byl4J and the reflexivity axiom. D 

Unlike Lemma 111 the next lemma requires that a constant specification CS 
be C-axiomatically appropriate. 

Lemma 2. Let CS be C-axiomatically appropriate and A he a formula. 

1. For any t G Tnic, there is a term IqI G Tmc such that 

'^cs [i\cA — 7> [!ci]c [i]c^- [C-inspection] 

2. For any t G Tmc, there is a term -^ t G Tnic such that 

^cs [t]cA -^ [^ t]c [ccli(t)]EA. {Q-shift) 

Proof. 1. Set \ct := ind(c, ccblO), where [c]c{[t]cA -^ [ccl2(t)]E [t]cA) G CS. 
2. Set ^t:=c -c (let), where [c]c(Mc^ ^ [cc\i{t)]EA) G CS. D 

The following two theorems are standard in justification logics. Their proofs 
can be taken almost word for word from |Art01) and are, therefore, omitted here. 

Lemma 3 (Deduction Theorem). Let CS be a constant specification and 
A U {A, B} C Fm, pc . Then A, A \-cs B if and only if Z\ hc5 A ^ B. 

h 

Lemma 4 (Substitution). For any constant specification CS, any proposi- 
tional variable P , any A U {A, B\ C Fnii pc , any x € Var®, and any t € Tin@j 

h 

ifA^csA, then A{x/t,P/B)hcs(x/t,p/B) A{x/t,P/B) , 

where A(x/t, P/B) denotes the formula obtained by simultaneously replacing all 
occurrences of x in A with t and all occurrences of P in A with B, accordingly 
for A{x/t,P/B) andCS{x/t,P/B). 

The following lemma states that our logic can internalize its own proofs, 
which is an important property of justification logics. 

Lemma 5 (C-lifting). Let CS be a pure C-axiomatically appropriate constant 
specification. If 

[si]cBi, . . . , [Sn]cBn, Ci, . . . , Cm ^CS A , 

then for each ®, there is a term t@(xi, . . . , a;„, j/i, . . . , ym) € Tm® such that 

[si]cBi,... , [Sn]cBn, [j/l]® Ci , . . . , [ym]®C'.m \-CS fe (si , • . . , S„ , 2/i , . . .,2/™)]®^ 

for fresh variables j/i , . . . , y„i G Tm® . 

Proof. We proceed by induction on the derivation of A. 

If A is an axiom, there is a constant c G Tmc such that [c]cA G CS because 
CS is C-axiomatically appropriate. Then take 

tc ■= c, ti :=iiC, tE ■= ccli(c) 



and use axiom necessitation, axiom necessitation and i-conversion, or axiom 
necessitation and the co-closure axiom respectively. 
For A = [sj]cBj, 1 < j <n, take 

tc :=!cSj, ti :=|i!cSj, t^ := cc\2{sj) 

and use C-inspection, C-inspection and i-conversion, or the co-closure axiom 
respectively. 

For A = Cj, 1 < j < m, take i® := yj € Varg) for a fresh variable yj. 

For A derived by modus ponens from D — >■ A and D, by induction hypothesis 
there are terms r®, s® S Tmg, such that [r^]^{D — >■ A) and [s®]®!) are provable. 
Take i® := r(^ -(^ S(^ and use ©-application, which is an axiom for ® = i and for 
(§) = C or follows from Lemma [T] for ® = E. 

For A = [c]cE E CS derived by axiom necessitation, take 

ic :=!cc, ti :=ii!cc, is := ccbCc) 

and use C-inspection, C-inspection and i-conversion, or the co-closure axiom 
respectively. D 

Corollary 6 (Constructive necessitation). LetCS be a pure C-axiomatical- 
ly appropriate constant specification. For any formula A, if \-cs ^; then for 
each ®, there is a ground term t € Tni® such that \-cs [t]®A. 

The following two lemmas show that our system LP^^ can internalize versions 
of the induction rule used in various axiomatizations of 54^^ (see |BKS09) for a 
discussion of several axiomatizations of this kind) . 

Lemma 7 (Internalized induction rule 1). LetCS be a pure C-axiomatically 
appropriate constant specification. For any formula A, if \-cs ^ ^^ [s]e^, there 
is a term t G Tmc such that \-cs A — > [ind(i, s)]c^. 

Proof. By constructive necessitation, there exists a term t € Tmc such that 
'^CS [t]c{A — ^ [s]e^). It remains to use the induction axiom and propositional 
reasoning. D 

Lemma 8 (Internalized induction rule 2). LetCS be a pure C-axiomatical- 
ly appropriate constant specification. For any formulae A and B, if we have 
'^cs B — >■ [s]e(A A B), then there exist a term t G Tmc OLnd a constant c G Tmc 
such that \-cs B ^ [c- ind(i, s)]cA, where [c]c{A A B ^ A) e CS. 

Proof. Assume 

^cs B ^ [sUA A B) . (3) 

From this we immediately get \-cs A A B ^ ['S]e(^ A B). Thus, by Lemma [t] 
there is a t G Tmc with 

hcsAAB^ [ind(i, s)]c{A A B) . (4) 



Since CS is C-axiomatically appropriate, there is a constant c G Tmc such that 

^cs [c]c{AAB^A) . (5) 

Making use of C-apphcation, we find by Q and ^ that 

^csAAB^ [c-ind(t,s)]c(A) . (6) 

From ([3| we get by E-reflexivity that 'res B ^ AA B. This, together with ^, 
finahy yields \-cs B ^ [c- ind(i, s)]c{A). D 

4 Soundness and Completeness 

Definition 9. An AF-model meeting a constant specification CS is a structure 
A4 — (W,i?, £,i^), where {W^K^v) is a Kripke model for S4;i with a set of 
possible worlds W y^ 0, with a function R: {1, . . . , /i} — >■ 'P{W x W) that assigns 
a reflexive and transitive accessibility relation on W to each agent i € {1, . . . , /i}, 
and with a truth valuation v. Prop — >■ V{W). We always write Ri instead of R{i) 
and define the accessibility relations for mutual and common knowledge in the 
standard way: Re := Ri U ■ ■ ■ U Rh and Re '■= U^iI-^^e)"- 

An evidence function £ : W x Tm — )• V I FniLpc ) determines the formulae 

evidenced by a term at a world. We define £(g, := £ \ {W x Tmg,). Note that 
whenever A G £®(w,t), it follows that t S Tm®. The evidence function £ must 
satisfy the following closure conditions: for any worlds w,v G W , 

1. £^,(w,t) C £^,(v,t) whenever {w,v) € i?*; (monotonicity) 

2. if [c](gA € CS, then A G £®{w, c); {constant specification) 

3. if {A ^ B) G £* {w, t) and A G £* (w, s), then B G £* {w, t • s); (application) 
4- £^.{w,s)U £^,{w,t) C £^,{w,s + t); (sum) 

5. if A G £i{w,t), then [t]iA G £i{w, It); (inspection) 

6. if A G £i(w,ti) for all I < i < h, then A G £e(w, (ii, . . . ,th)): (tupling) 

7. if A G £E(w,t), then A G £i(w,'!rit); (projection) 

8. if A G £c(w,t), then A G £E(w,cc\i(t)) and[t]cA G £E(uj,cc\2(t)); (co-closure) 

9. if Ag £e(w,s) and (A -> [s\eA) g £c(w,t), 

then A G £c(w,\nd(t, s)). (induction) 

When the model is clear from the context, we will directly refer to i?i, . . . , Rh, 
Re, Rc, £i,- ■ ■ ,£h, £e, £c, W, and ly. 

Definition 10. A ternary relation A4,w Ih A for formula A being satisfied at 
a world w G W in an AF-model A4 = (W, R,£,v) is defined by induction on the 
structure of the formula A: 

1. Ai,w Ih P if and only if w G i^(P); 

2. Ih behaves classically with respect to the propositional connectives; 

3. M,w Ih [t]®A if and only if 1) A G £®(w, t) and 2) M,v\\- A for all v G W 
with (w,v) G i?@. 



We write M \\- A if M,w Ih A for all w e W. We write W-qs A and say 
that formula A is valid with respect to CS if M \\- A for all AF-models A4 
meeting CS. 

Lemma 11 (Soundness). Provable formulae are valid: hcs A implies W-qs A. 

Proof Let M = {W,R,£,v) be an AF-model meeting CS and let w G W.We 

show soundness by induction on the derivation of A. The cases for propositional 

tautologies, for the application, sum, reflexivity, and inspection axioms, and for 

modus ponens rule are the same as for the single-agent case in |Fit05j and are, 

therefore, omitted. We show the remaining five cases: 

(tupling) Assume A4,w \\- [ti]iA for all 1 < j < ft.. Then for all 1 < i < h, we 
have 1) M,v Ih A for all v £ W with {vu,v) € R, and 2) A e £i{w,ti). So, 
by the tupling closure condition, A e £e{w, {ti, . . . ,th)) from 2). Since by 
definition Re = Ui=i^ij it follows from 1) that A4,v Ih A for all w e W 
with (ui, v) e Re- Hence, A^, u; Ih [{ti, . . . , th)]EA. 

(projection) Assume Ai,w Ih [t]EA. Then 1) M,v Ih A for all v & W with 
(w,w) e -Re and 2) A £ £E{w,t). By the projection closure condition, it 
follows from 2) that A E £i{w,TTit). In addition, since Re = Ui=i ^i; ^^ S^t 
M,v\\- A for aWv eW with {w, v) € Ri by 1). Thus, A^, w; Ih [Trit]iA. 

(co-closure) Assume M,w Ih [t]cA. Then 1) A4,v Ih A for all v € W with 
{w, v) e Re and 2) A e f c(w, t). It follows from 1) that for aU v' e W with 
{w, v') e i?Ej we have M.,v' \\- A since i?E C i?^; also, due to the monotonic- 
ity closure condition, M.,v' Ih [t\cA since i?E ° -Re ^ i?c. From 2), by the 
co-closure closure condition, A e £e(w, ccli(t)) and [t]cA e £e(w, ccl2(i)). 
Hence, 7W,ii; Ih [ccli(i)]E^ and M,w Ih [ccl2(t)]E [t]cA. 

(induction) Assume M^w Ih A and A^, w Ih [i]c(^ -^ [s\eA). From the second 
assumption and the reflexivity of i?c, we get A^,w Ih A — > [s]ev4; thus, 
A^,w Ih [s\eA by the first assumption. So A S £e{wtS) and, by the second 
assumption, A — > [s]eA G fclwji). By the induction closure condition, we 
have A e £c{w, ind(i, s)). To show M,v\\- A for aU v g W^ with (w, w) e i?c, 
we prove that A^, i; Ih ^ for all u G M^ with (w, v) e (Re)" by induction on 
the positive integer n. 

The base case n = I immediately follows from A^,^ Ih [s]e^. 
Induction step. Let {w,v') S (Re)"' and {v',v) E Re for some v,v' E W. 
By induction hypothesis, M,v' Ih A. Since M,w Ih [t]c(^ — > [*]e^), we get 
M,v' \\- A^ [s]eA. Thus, M,v' Ih [s]eA, which yields A^,w Ih A. 
Finally, we conclude that Ai,w Ih [ind(i, s)]c^. 

(axiom necessitation) Let A be an axiom and c be a proof constant such that 
[c]^A E CS. Since A is an axiom, A^, w Ih A for all w E W, as shown above. 
Since M is an AF-model meeting CS, we also have A E £@{w,c) for all 
w eW hy the constant specification closure condition. Thus, M,w Ih [c\@A 
for all w EW. D 

Definition 12. Let CS he a constant specification. A set (p of formulae is called 
C5-consistent if (p i^cs 4' for some formula <f). A set <P is called maximal CS- 
consistent if it is CS-consistent and has no CS-consistent proper extensions. 



Whenever safe, we do not mention the constant specification and only talk about 
consistent and maximal consistent sets. It can be easily shown that maximal 
consistent sets contain all axioms of LP^^ and are closed under modus ponens. 

Definition 13. For a set <P of formulae, we define 

<^/® := {A : there is at e Tm® such that [t]@A e <P} . 

Definition 14. Let CS he a constant specification. The canonical AF-model 
A^ — {W, R,£ ,v) meeting CS is defined as follows: 

1. W '■= {w C Fnii pc : w is a maximal CS-consistent set\; 

h 

2. Ri := {{w, v)&W y.W : w/iC v}; 

3. £!s,(w,t) ■.= {AeFm,pc : ft]®A e u;}; 

h 

I HPn) -.^{weW : P„ e w}. 

Lemma 15. Let CS be a constant specification. The canonical AF-model meet- 
ing CS is an AF-model meeting CS. 

Proof. The proof of reflexivity and transitivity of each Ri, as well as the ar- 
gument for the constant specification, application, sum, and inspection closure 
conditions, is the same as in the single-agent case (see IFitOSp . We show the 
remaining five closure conditions: 

(tupling) Assume A € £i{w,ti) for all 1 < i < h. By definition of £i, we have 
[ii]iA e w for all I < i < h. Therefore, by the tupling axiom and maximal 
consistency, [(ti, . . . ,th)]EA € w. Thus, A € £e{w, {ti, . . . ,th)). 
(projection) Assume A G £e[w, t). Thus, we have [t]E^ € w. Then, by the pro- 
jection axiom and maximal consistency, [TTiiJjA € w, and thus A G £i{w, TTji). 
(co-closure) Assume A G £c{w,t). Thus, [i]c^ G w, and, by the co-closure 
axioms and maximal consistency, [ccli(i)]E^ S w and [ccl2(i)]E [i]c^ G w. 
Hence, A G £E{w,cc\i{t)) and [t]cA € £e{'w , cc\2{t)) . 
(induction) Assume A G £e{w,s) and {A — > [s]eA) e £c{w,t). Then we have 
[s]eA e w and [t]c{A -^ [s]eA) G w. From \-cs [s]eA -> A (Lemma [Tjl I 



and the induction axiom, it follows by maximal consistency that A £ w and 
[ind(t, s)]cA G w. Therefore, A e £c{'w, \nd{t, s)). 
(monotonicity) We show only the case of * = C since the other cases are 
the same as in |Fit05| . It is sufficient to prove by induction on the positive 
integer n that 

if [t]cA e w and {w,v) G (i?E)", then [t]cA ev . (7) 

Base case n — 1. Assume (w, v) e Re, i.e., w/i C v for some i. As [t]cA e w, 
[TTiCc\2it)]i [t]cA e w by maximal consistency, and hence [t]cA £ w/i C v. 
The argument for the induction step is similar. 

Now assume {w,v) £ Rq = U^i(^e)" and A £ £c{w,t), i.e., [t]cA £ w. As 
shown above, [t]cA £ v. Thus, A £ £c{v, t). D 
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Remark 16. Let R'q denote the binary relation on W given by 

(w,w) G R'q if and only if w/C C ti . 

An argument similar to the one just used for monotonicity shows that -Re Q R'c- 
However, the converse does not hold for any pure C-axiomatically appropri- 
ate constant specification CS, which we demonstrate by adapting an example 
from |MvdH95) . Let 

'^:={[s„]e...[si]eP : n > 1, si, . . . , s„ G TmEJ U {- ^cP : t G Tnic} . 

This set is C5-consistent for any P G Prop. 

To see this, let <?' C ^ be finite and let m denote the maximal number of 
terms such that [s„,]e . . . [si]e-P G ^'. Define the model TV := [N.R^ ,£^ , u^) 
by 

- i?f := {(n, n + 1) G N^ : n mod h^i}\J {{n, n) G N^ : n G N}; 

- £ (n, s) :— Fmi pc for all n G N and terms s G Tm; 

h 

- jy^(P) := {1, 2, . . . , m + 1} C N. 

Clearly, Af meets any constant specification; in particular, it meets CS. ft can 
also be easily verified that J\f, 1 Ih <?'; therefore, ^' is C5-consistent. 

Since <? is C5-consistent, there exists a maximal C5-consistent set w ^ 'P. 
Let us show that the set 'F :— {^P} U (w/C) is also C5-consistent. Indeed, if it 
were not the case, there would exist formulae i?i, . . . , i?„ G w/C such that 

hcs Bi^iB2^ > {Bn -^P)...) . 

Then, by Corollary |6l there would exist a term s G Tmc such that 

^cs [s]dBi -> (B2 ^ . . . ^ (S„ ^ P) . . . )) ■ 

But this would imply [(. . . {s ■ ti) ■ ■ ■ t„-i) • tn]cP G w for [tj]cBj G w, 1 < j < n, 
a contradiction with the consistency of w. 

Let w be a maximal C5-consistent set that contains 'F, i.e., v ^ 'F. Clearly, 
w/C C V, i.e., {w,v) G i?cj but {w,v) ^ Re because this would imply P <E v, 
which cannot happen. It follows that Re C R'^. 

Similarly, we can define R'^ by {w,v) G R'^ if and only if w/E C v. However, 
i?g = i?E for any C-axiomatically appropriate constant specification CS. Indeed, 
is easy to show that R^ C R!^. For the converse, assume [w^v) ^ _Re, then 
(i«,w) ^ Ri for all I < i < /i. So there are formulae Ai, . . . ,Ah such that 
[U]iAi G w for some U G Tm^, but Ai ^ v. Now let [cj]c(^i -^ AiW ■ ■ -W Ah) G CS 
for constants Ci, . . . , c/j. Then [| jQ • ii]i(Ai V • • • V A^) G w for all 1 < i < h, so 
[(iici •ii,...,iftC/i ■th)]E{AiV---VAh) G w. However, A^ (^ i; for any I < i < h; 
therefore, by the maximal consistency of u, Ai \/ ■ ■ ■ \/ Ah ^ v either. Hence, 
w/E ^ V, so {w,v) ^ i?£. 

Lemma 17 (Truth Lemma). LetCS be a constant specification and AA he the 
canonical AF-model meeting CS. For all formulae A and all worlds w G W , 

A Q w if and only if A4,w \\- A . 



II 



Proof. The proof is by induction on the structure of A. The cases for proposi- 
tional variables and prepositional connectives are immediate by the definition 
of Ih and by the maximal consistency of w. We check the remaining cases: 
Case A is [t]iB. Assume A G w. Then B e w/i and B G £i{w,t). Consider 
any v such that {w,v) G Rt. Since w/i C v, it follows that B Cz v, and thus, by 
induction hypothesis, A4, v Ih B. And Ai, w \\- A immediately follows from this. 
For the converse, assume A^, w Ih [t]iB. By definition of Ih we get B G £i{w, t), 
from which [t]iB G w immediately follows by definition of £i. 
Case A is [^Je-S- Assume A G w and consider any v such that {w,v) G Re- 
Then (w, u) G Ri for some 1 < i < /i, i.e., w/i C v. By definition of S^, we 
get B G £E{w,t). By maximal consistency of w, it follows that [7rit]i_B G w, and 
thus i? G w/i C i;. Since, by induction hypothesis, M.,v Ih B, we conclude that 
A^,w Ih A. The argument for the converse repeats the one from the previous 
case. 

Case A is [t]cB. Assume ^ G w and consider any v such that {w,v) G Re, 
i.e., {w,v) G (Re)" for some n > 1. As in the previous cases, B G £c{w,t) by 
definition of Sq. By (I?]) we find A £ v, and thus, by C-reflexivity and maximal 
consistency, also B G v. Hence, by the induction hypothesis Ai,v Ih B. Now 
A4,w\\- A immediately follows. The argument for the converse repeats the one 
from the previous cases. D 

Note that the converse directions in the proof above are far from trivial in 
the modal case, see e.g. |MvdH95] . The last case, in particular, usually requires 
more sophisticated methods that guarantee the finiteness of the model. 

Theorem 18 (Completeness). LP,j(C5) is sound and complete with respect 
to the class of AF-models meeting CS , i.e., for all formulae A G Fmipc , 

h 

\-cs A if and only if W^cs A . 



Proof. Soundness has already been shown in Lemma 11 For completeness, let 
A^ be the canonical AF-model meeting CS and assume V-cs A. Then {^A} is 
CiS-consistent and hence is contained in some maximal C5-consistent set w G W . 
So, by Lemma[T7J M.,w II — 'A, and hence, by Lemma [TS] Ih^^ A. D 

M-models were introduced as semantics for LP by Mkrtychev |Mkr97| . They 
form a subclass of F-models (see |Fit05| ). 

Definition 19. An M-model is a singleton AF-model. 

Theorem 20 (Completeness with respect to M-models). LP,j(C5) is also 
sound and complete with respect to the class of M-models meeting CS. 

Proof. Soundness follows immediately from Lemma [Tl] Now assume that l^cs A, 
then {^A} is C5-consistent, and hence A4,w II — A for some world wq G W in 
the canonical AF-model A4 = {W, R,£, v) meeting CS. 

Let M' = {W',R',£',v') be the restriction of 7W to {wq}, i.e., W := {wq}, 
R'^ := {{wo, wo)} for any ®, £' := £ \ {W x Tm), and u'{P„) := i^(P„) n W. 
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Since M.' is clearly an M-model meeting CiS, it remains to demonstrate that 
M.\wq Ih B if and only \i M.,wq Ih _B for all formulae B. We proceed by induction 
on the structure of B. The cases where either i? is a prepositional variable or 
its primary connective is propositional are trivial. Therefore, we only show the 
case oi B = \t\(^C . First, observe that 



M,wq Ih [i]®C if and only if C G £c^{wq, t) 



(8) 



Indeed, by Lemma 17 M.,wo Ih [tJgC if and only if [t]®C S wq, which, by 
definition of the canonical AF-model, is equivalent to C G £rg,{wQ,t) — £^{wo,t). 

li M,Wo Ih [t]®C, then M,Wq Ih C since i?@ is reflexive. By induction 
hypothesis, M' , Wq Ih C. By ([s]) we have C € £'^{wo, t), and thus M' , Wq Ih [t]g,C. 

If M,w„ r [i\®C, then by ^ we have C | £'^{w, t), so M' , wq ¥ [t]®C. D 

Corollary 21 (Finite model property). VPyJ^CS) enjoys the finite model 
property with respect to AF-models. 



5 Conservativity 

Yavorskaya in [YavOSj introduced a two- agent version of LP, which we extend to 
an arbitrary h in the natural way: 

Definition 22. The language of LP/; is obtained from that of LP^ by restrict- 
ing the set of operations to -i, +i, and \i and by dropping all terms from Tuie 
and Tnic- The axioms are restricted to application, sum, reflexivity, and inspec- 
tion for each i. The definition of constant specification is changed accordingly. 

We show that LP,j is conservative over LPh by adapting a technique from |FitQ8| . 

Definition 23. The mapping x : Fm|_pc — > FniLp^ is defined as follows: 

1. P^ := P for propositional variables P G Prop; 

2. X commutes with propositional connectives; 

\ A^ if t contains a subterm s G TniE U Tmc, 

1 [t]®A^ otherwise. 

Theorem 24. Let CS be a constant specification for LP^^. For an arbitrary for- 
mula A G FmLP^, if IPhiCS) h A, then LPh{CS'') h A. 

Proof. Since A^ = A for any A G FmLp,^, it suffices to demonstrate that for any 
formula D G Fm, pc , if LP^(C5) h D, then LPh(CS'') h Z?^, which can be done 

h 

by induction on the derivation of D. 

Case when D is a, propositional tautology, then so is Z?^. 

Case when D — [t]iB — > i? is an instance of the reflexivity axiom. Then D^ is 

either [t]iB^ — )■ B^ or B^ —>■ B^ , i.e., an instance of the reflexivity axiom 

of LP/i or a propositional tautology respectively. 

Case when D = [t]^,{B — >■ C) — )■ {[s]^,B — >■ [t • s]*C) is an instance of the 

application axiom. We distinguish the following possibilities: 
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1. Both t and s contain a subterm from TniE U Tmc- Then D^ has the form 
{B^ -^ C^) -^ {B^ -^ C^), which is a prepositional tautology and, thus, an 
axiom of LP/j. 

2. Neither t nor s contains a subterm from TniE U Tmc- Then D^ is an instance 
of the application axiom of LP/j. 

3. Term t contains a subterm from Tuie U Tmc while s does not. Then D^ is 
(^x ^ C^) ^ {[shB'' -^ C^), which can be derived in LP,,(C5^) from 
the reflexivity axiom [s]iB^ — > B^ by propositional reasoning. In this case, 
translation x does not map an axiom of LP^^ to an axiom of LP^. 

4. Term s contains a subterm from Tihe U Tmc while t does not. Then D^ is 
[t]i{B^ — ^ C^) — ^ {B^ — > C^), an instance of the reflexivity axiom of LP/j. 

Case when D — [t]^,B -^ [t + s]*J3 is an instance of the sum axiom. Then D^ be- 
comes B^ -^ B^ , [t\iB^ -^ B^, or [t]iB^ -> [t + s\iB^ , i.e., a propositional 
tautology, an instance of the reflexivity axiom of LP^, or an instance of the sum 
axiom of LP/j respectively. The sum axiom [s\^:B -^ [t + s\^B is treated in the 
same manner. 

Case when D = \t\iB -^ [!i]i [i\iB is an instance of the inspection axiom. Then 
D^ is either the propositional tautology B^ -^ B^ or [t\iB^ —> [lt]i [t]iB'^ , an 
instance of the inspection axiom of LPh- 

Case when D = [ti]iB A • • • A [th]hB — ^ [(ii, . . . ^th)]^B is an instance of the 
tupling axiom. We distinguish the following possibilities: 

1. At least one of the t^'s contains a subterm from TmE U Tmc. Then D^ has 
the form Ci A ■ ■ ■ ACh ^ B^ with at least one Ct = B^ and is, therefore, a 
propositional tautology. 

2. None of the i^'s contains a subterm from TmE U Tmc. Then D^ has the form 
[<i]i-B^ A • • • A [th]hB'^ -^ S^, which can be derived in LP,,(C5'') from the 
reflexivity axiom. This is another case when translation x does not map an 
axiom of LP/^ to an axiom of LP/;. 

Case when D is an instance of the projection axiom [i]E-B -^ ['Kit\iB or of the 

co-closure axiom, i.e., [t\cB ^- [ccli(i)]E-B or [t\cB — ^ [ccl2(i)]E [t]cB. Then D^ is 

the propositional tautology B^ — > B^. 

Case when D = B A [t]c{B — >■ [sJe-B) -^ [\nd(t,s)]cB is an instance of the 

induction axiom. Then D^ is B^ A{B^ -^ B^) -^ B^ , a. propositional tautology. 

Case when D is derived by modus ponens is trivial. 

Case when D is [c](f)B G CS. Then D^ is either B^ or [c]iB^ . In the former 

case, B is an axiom of LP^, and hence B^ is derivable in LP/j(C5^), as shown 

above; in the latter case, [cJ^-B^ G CS^ . D 

Remark 25. Note that CS need not, in general, be a constant specification 
for LP/j because, as noted above, for an axiom D of LP^, its image D^ is not 
always an axiom of LP/i. To ensure that CS^ is a proper constant specification, 
[A ^ B) ^ {[s\^A -^ B) and [ti]iA A • • • A [th]hA ^ A have to be made 
axioms of LP/j. Another option is to use Fitting's concept of embedding one 
justification logic into another, which involves replacing constants in D with 
more complicated terms in D^ (see |Fit08| for details). 
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6 Forgetful Projection and a Word on Realization 

Most justification logics are introduced as explicit counterparts to particular 
modal logics in the strict sense described in Sect. [T] Although the realization 
theorem for LP^^ remains an open problem, in this section we prove that each 
theorem of our logic LP^ states a valid modal fact if all terms are replaced with 
the corresponding modalities, which is one direction of the realization theorem. 
We also discuss approaches to the harder opposite direction. 

We start with recalling the modal language of common knowledge. Modal 
formulae are defined by the following grammar 

A ::= Pj \ ^A\ {A ^ A) \ {Ay A) \ {A -^ A) \ U.A | E^ | CA , 

where Pj e Prop. The set of all modal formulae is denoted by Fm54c . 

The Hilbert system S4^ [MvdH95] is given by the modal axioms of S4 for 
individual agents, by the necessitation rule for ni,...,n^, and C, by modus 
ponens, and by the axioms 

Q{A^ B)^ {CA^CB), CA^A, EA^U^AA- ■ ■ hUhA, 
AaC(A-> EA) ^CA, CA^£{AaCA). 

Definition 26 (Forgetful projection). The mapping o: Fmipc — > Fnic4c is 

h h 

defined as follows: 

1. P° ■— P for propositional variables P G Prop; 

2. o commutes with propositional connectives; 

3. rn.AY := U,A°; 
I ([%^)° := EA°; 
5. {[t]cA)° ■.= CA°. 

Lemma 27. Let CS he any constant specification. For any formula A G Fm|_pc , 
if \-Ph{CS) V- A, then S4^ h A° . 

Proof. The proof is by easy induction on the derivation of A. D 

Definition 28 (Realization). A realization is a mapping r: Fin54c — > Fin|_pc 
such that [r{A))° = A. We usually write A^ instead of r{A). 

We can think of a realization as a function that replaces occurrences of modal 
operators (including E and C) with evidence terms of the corresponding type. 
The problem of realization for a given pure C-axiomatically appropriate constant 
specification CS can be stated as follows: 

Is there a realization r such that LP,j(C5) h A^ for any theorem A of S4,j? 

A positive answer to this question would constitute the harder direction of the 
realization theorem, which is often demonstrated using induction on a cut-free 
sequent proof of the modal formula. 
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Cut- free systems for S4^ are presented in |AJ05) and |BS09| . They are based 
on an infinitary w-rule of the form 

E™A, r for aU m > 1 

cvr (")• 

However, reahzation of such a rule meets with serious difficulties in reaching 
uniformity among the realizations of the approximants E™yl. 

A finitary cut-free system is obtained in |JKS07j by finitizing this w-rule via 
the finite model property. Unfortunately, the "somewhat unusual" structural 
properties of the resulting system (see discussion in |JKS07j ) make it hard to 
use it for realization. 

The non-constructive, semantic realization method from |Fit05j cannot be 
applied directly because of the non-standard behavior of the canonical model 



(see Remark 16). 



Perhaps the infinitary system presented in |BKS09| , which is finitely branch- 
ing but admits infinite branches, can help in proving the realization theorem 
for LP^j. For now this remains work in progress. 



7 Coordinated attack 

To illustrate our logic, we will now analyze the coordinated attack problem 
along the lines of JFHMV95] . where additional references can be found. Let us 
briefiy recall this classical problem. Suppose two divisions of an army, located 
in different places, are about to attack an enemy. They have some means of 
communication, but these may be unreliable, and the only way to secure a victory 
is to attack simultaneously. How should generals G and H who command the two 
divisions coordinate their attacks? Of course, general G could send a message mf 
with the time of attack to general H . Let us use the proposition del to denote 
the fact that the message with the time of attack has been delivered. If the 
generals trust the authenticity of the message, say because of a signature, the 
message itself can be taken as evidence that it has been delivered. So general ff, 
upon receiving the message, knows the time of attack, i.e., \rni\Hdd. However, 
since communication is unreliable, G considers it possible that his message has 
not been delivered. But if general H sends an acknowledgment m2 , he in turn 
cannot be sure whether the acknowledgment has reached G, which prompts yet 
another acknowledgment m^ by general G, and so on. 

In fact, common knowledge of del is a necessary condition for the attack. In- 
deed, it is reasonable to assume it to be common knowledge between the generals 
that they should only attack simultaneously or not attack at all, i.e., that they 
attack only if both know that they attack: [t]c{att — > [sJEott) for some terms s 
and t. Thus, by the induction axiom, we get att — > [\r\d{t, s)]catt. Another rea- 
sonable assumption is that it is common knowledge that neither general attacks 
unless the message with the time of attack has been delivered: [r]c{att -^ del) 
for some term r. Using the application axiom, we obtain att — > [r ■ ind(i, s)]cdel. 
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We now show that common knowledge of del cannot be achieved and that, 
therefore, no attack will take place, no matter how many messages and acknowl- 
edgments mf , 1122 , "^3 I • • ■ ^^^ ^6^t by the generals even if all the messages are 
successfully delivered. 

In the classical modeling without evidence, the reason is that the sender of 
the last message always considers the possibility that his last message, say m^f., 
has not been delivered. To give a flavor of the argument carried out in detail 
in |FHMV95] . we provide a countermodel where to|^ is the last message, it has 
been delivered, but H is unsure of that, i.e., [mfj/^de/, [m|'^]G[mf ]//(ieZ, but 
^ [s]// [m|'^]G['Tif jffC^e/ for all terms s. Indeed, consider the model A4 with 
W := {0,1,2,3}, v{del) := {0,1,2}, Rg being the reflexive closure of {(1,2)}, 
Rh being the reflexive closure of {(0, 1), (2, 3)}, and any evidence function £ 
such that del G ^^(Ojmf) and [mfj/^rfe/ G fG(0, mf'^). Then, whatever £c is, 
we have M,Ol>f^ [s]h [1^2] g [mf ] _y de/ and A1, U^ [tjcrfe? for any s and t because 
M,3l^ del. 

In our models with explicit evidence, there is an alternative possibility for 
the lack of knowledge: the absence of evidence. For example, G may receive the 
acknowledgment 1712 but not consider it to be evidence for [mf\ h del because 
the signature of H is missing. 

We now demonstrate that common knowledge of the time of attack cannot 
emerge, basing the argument solely on the lack of common knowledge evidence. 
A corresponding M-model Ai = {WjRjE,^) is obtained as follows: W := {w}, 
Ri := {{w, w)}, ly(del) :— {w}, and £ is the minimal evidence function such that 
del g £H{w,mf) and [mf]_f/(ie/ e £^10,1712)- In this model M,w H^ [t]cdel 
for any evidence term t because del ^ £c{w,t) for any t. To show the latter 
statement, note that for any term t, by Lemma [27} 

F [■mf]Hdel A [mf ] g [mf ] ^rfeZ -^ [t]cdel (9) 

because 

S4^ F Ondel A DGOHdel -^ Cdel , 

which is easy to demonstrate. Thus, the negation of the formula from ^ is satis- 
fiable, and for each t there is a world Wt in the canonical AF-model with evidence 
function £'"^'^ such that del e £jf'^{wt,mf) and [mfj/fde/ G £g'"(u)t, m|^), but 



by the Truth Lemma[T7) del ^ £l'''^{wt,t). Since f'^^" \ {{wt} x Tm) satisfies all 
the closure conditions, minimality of £ implies that £c{w,s) C £^^^{wt,s) for 
any term s. In particular, del ^ £c{w,t) for any term t. 



8 Conclusions 

We have presented an explicit evidence system LP^^ with common knowledge, 
which is a conservative extension of the multi-agent explicit evidence logic LP/j. 
The major open problem at the moment remains proving the realization theorem, 
one direction of which we have demonstrated. 
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Our analysis of the coordinated attack problem in the language of LP^ shows 
that access to explicit evidence creates more alternatives than the classical modal 
approach. In particular, the lack of knowledge can occur either because messages 
are not delivered or because evidence of authenticity is missing. 

We have mostly concentrated on the study of C-axiomatically appropriate 
constant specifications. For modeling distributed systems with different reason- 
ing capabilities of agents, it is also interesting to consider i-axiomatic appro- 
priate, E-axiomatic appropriate, and mixed constant specifications, where only 
certain aspects of reasoning are common knowledge. 

We established soundness and completeness with respect to AF-models and 
singleton M-models. Can other semantics for justification logics such as (arith- 
metical) provability semantics }Art951 lArtOl] and game semantics |Ren09b] be 
adapted to LP^j? 

There are further interesting questions: Is LP^ decidable and, if yes, what is 
its complexity compared to that of S4^? How robust is our treatment of common 
knowledge if the individual modalities are taken to be of type K, K5, etc.? 
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